Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I am having difficulty with Wordpress continually changing my code on me. IE:

FROM THIS:

<script type="text/javascript" src="<?php echo get_stylesheet_directory_uri(); ?>/js/swfobject.js" ></script>

TO:

<script src="&lt;?php echo get_stylesheet_directory_uri(); ?" type="text/javascript">// <![CDATA[
/js/swfobject.js" >
// ]]></script>

And it's driving me crazy... is there anyway to disable this from happening? I will be having other people edit these pages so to disable the "GUI EDITOR in the users profile" doesn't seem like a good solution.

Any help is appreciated.

share|improve this question

migrated from stackoverflow.com Jun 12 '11 at 0:26

This question came from our site for professional and enthusiast programmers.

4  
Why are you trying to load scripts as page content? Anyway, my best idea is to find or write a plugin that loads swfobject.js for you. –  Neil Jun 9 '11 at 23:21

2 Answers 2

<script> tags go in the document head, not in the document body (or, if in the document body, they should be the very last thing before the closing </body> tag.

Besides, if you're adding code of any sort in your post, you're going to run into issues if you use the Visual editor, or, more likely, if you're switching between the Visual and HTML editors.

share|improve this answer
2  
Not to mention, WordPress does not eval() PHP code written in the post content area. I believe there are plugins which add this as a filter, but I don't know why it should be necessary; I'm sure you know what your stylesheet directory is, so there's no need for the PHP function in there. –  goldenapples Sep 12 '11 at 3:58

Aside from the bad practice of adding script tags in your post content, you're actually including PHP calls, which is horrendous security practice.

There are plugins that can make this possible, but I would strongly recommend against them, and measures to make this work will almost certainly cripple the effectiveness of your security. Defacement or malware hijack attacks would be highly likely, and if your client is in anyway tech savvy, they'll likely demand their money back.

Put this kind of call in the header.php or the footer, it should never be inside your post content.

I cannot stress how big a flaw this is, and I would consider code like this to be an urgent issue, regardless of wether it worked or not, not just from a security and maintenance point of view, but from a code quality and design viewpoint. This sort of thing always comes back and bites you on the arse with more work to fix things.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.